25 Questions to Ask a Visitor Management Vendor Before You Buy

Published on 10/31/2026

Banner illustration for the article: 25 Questions to Ask a Visitor Management Vendor Before You Buy

A facilities head sits through three vendor demos in one week. Every demo shows a smooth check-in, a clean dashboard and a badge printing. Every vendor says yes to every question. Three months after signing, the chosen system cannot export her own visitor data without a support ticket, and the "unlimited" plan has a per-location fee nobody mentioned.

Demos are designed to look identical. The differences between visitor management vendors live in the answers to specific, slightly uncomfortable questions. The 15 below are grouped by theme: your data, day-two operations, compliance, commercial terms and the vendor itself. Ask them in writing, and treat vague answers as answers.

On this page

Data ownership and exit terms
Day-two operations
Compliance and security
Commercial terms
Scoring the answers
Reader Q&A
Bottom line

Data ownership and exit terms

Visitor logs are your records of who entered your premises. These three questions establish whether the vendor treats them that way.

1. Can we export our complete visitor data, unaided, at any time? The answer to listen for: a self-serve export to Excel or CSV from the dashboard, including photos and timestamps. A support ticket, a fee, or "we can provide that on request" means your data is held, not owned.
2. In which region is our data hosted, and who at the vendor can see it? You want a named cloud region and role-based internal access with an audit trail. "Industry-standard security" is not an answer.
3. What happens to our data if we leave? Listen for a defined exit process: full export, then deletion with confirmation, within a stated number of days. If this is not in the contract, put it there.

Key idea: Any vendor can show a working check-in. Only some can show you leaving with your data intact, and that is the demo worth asking for.

Day-two operations

The demo covers day one. These questions cover the Tuesday six months later, when the internet drops, the guard changes shift and a VIP walks in unannounced.

4. What happens at the gate when the internet goes down? Every cloud system has an answer; the question is whether it is designed or improvised. Listen for an offline fallback procedure and automatic catch-up when connectivity returns.
5. What is your uptime over the last 12 months, and where is it published? A status page with history is the answer you want. A verbal "99.9 percent" with no public record is marketing.
6. How does a new guard or receptionist learn the system? If the honest answer is "a two-day training programme", budget for retraining every time gate staff rotate, which in India is often. Systems designed for phones should take under an hour to learn.
7. When a host does not respond to an approval request, what does the system do? Escalation rules are the difference between a queue and a flow. Ask them to configure the fallback live, in front of you.

Notice the pattern in these four: none of them can be answered with a feature list. They force the vendor to describe behaviour under failure, rotation and neglect, which is where gate systems actually live. A vendor who answers them quickly has watched their product survive real receptions; a vendor who pivots back to the feature deck has not.

Compliance and security

Visitor data is personal data. Under the DPDP Act 2023, your organisation is the data fiduciary for what the gate collects, so the vendor's features become your compliance posture.

8. Can visitors' phone numbers be masked from other visitors, from printouts and from screen views? A visitor register that shows one visitor's number to the next is a liability whether it is paper or digital.
9. Can we set an automatic retention and deletion period? DPDP requires erasure once the purpose is served unless another law requires retention. Manual deletion routines fail; ask for automated, configurable purging.
10. Is every action in the system audit-trailed? Who edited a record, who exported data, who changed a setting. When an incident happens, the audit trail is the difference between an answer and a guess.
11. What certifications do you hold, and can we see the reports? SOC 2 or ISO 27001 are baseline for a company holding your visitor data. A certificate number you can verify beats a logo on a slide.

⚠️ Compliance note: The DPDP Act 2023 can levy significant penalties per instance for failing to protect personal data or notify breaches. Your vendor questionnaire answers should go to your legal team before signing, not after the first audit.

Ask us these 15 questions

VisitorFlow answers every one in writing: self-serve exports, masked data, automatic retention, escalation rules and a public record of how the platform runs.

Explore Visitor Management Software

Commercial terms

Two pricing pages can show the same monthly figure and produce bills that differ by a factor of three. These questions find the real number.

12. What is the total cost for our setup, in writing, for year one? Give the vendor your actuals: number of locations, gates, hosts, and visitors per month. The answer should be a single figure with every line item shown: licences, per-location fees, hardware, SMS or WhatsApp message charges, onboarding and support.
13. Which features in the demo are not in the plan we would buy? Vendors demo the top tier. Badge printing, watchlists, API access and multi-location dashboards are common paid add-ons. Ask for the demo to be marked up feature by feature.
14. What does support look like after go-live? Named channel (phone, WhatsApp, email), hours in your time zone, and a committed first-response time. "Email support" with 48-hour responses is a problem when your gate is stuck on a Monday morning.

The worked example below shows how quickly a headline price stops being the real price. The figures are illustrative; ask each vendor to fill in their own.

Worked example: year-one cost, 2 locations, 60 hosts

Headline plan price         = Rs 4,000 per month
Per-location fee (2nd site) = Rs 1,500 per month
WhatsApp notifications      = Rs 900 per month
Badge printing module       = Rs 700 per month
Onboarding (one time)       = Rs 6,000

Real year-one cost = (4,000 + 1,500 + 900 + 700) x 12 + 6,000
                   = Rs 91,200, not the Rs 48,000 the headline suggests

Scoring the answers

The fifteenth question is for your team, not the vendor: 15. Would we bet a surprise audit on this vendor's answers? Score each vendor with the same simple scale, and the decision usually makes itself.

Score	What the answer looks like	How to treat it
2 - Clear	Specific, demonstrated live or backed by a document you can verify	Counts fully in the comparison
1 - Vague	"Yes" without detail, or a promise to confirm later	Follow up once in writing; no follow-up answer means 0
0 - Avoided	Deflection, a different question answered, or a refusal to commit in writing	Treat as the worst realistic case for that question

A vendor scoring 25 or more out of 30 is a safe shortlist candidate. Below 20, the demo polish is carrying the evaluation, and the gaps will surface after signature.

Reader Q&A

Should we run a pilot before signing an annual contract?

Yes, and the vendor's reaction is itself an answer. A confident vendor offers a pilot on one gate for two to four weeks. Refusal or a long paid "proof of concept" tells you how the rest of the relationship will go.

Is the cheapest quote usually the best value?

Only after the year-one total in question 12. Per-location fees, message charges and add-on features routinely double a headline price. Compare totals, not monthly figures.

Do we need hardware-based systems for high-security sites?

Usually no. Turnstiles and biometric devices integrate with cloud visitor systems rather than replace them. What high-security sites actually need is watchlists, ID capture and audit trails, which are software features.

How many vendors should we evaluate?

Three. Fewer means no comparison; more turns the evaluation into a project of its own. Send all three the same 15 questions in writing on the same day, so answers arrive in comparable form.

Who inside our company should see the answers?

Three functions at minimum: security or admin (they run the gate), IT (they own integrations and data), and legal or compliance (the DPDP questions). A purchase approved by only one of the three tends to stall with the other two.

Should price or compliance decide the final pick?

Compliance gaps are disqualifying, price differences are negotiable. A vendor who cannot mask visitor numbers or purge old records creates DPDP exposure that no discount covers. Shortlist on questions 1 to 11 first, then negotiate on 12 to 14.

What is the single most revealing question?

Question 1, the data export. Vendors who make leaving easy are usually confident about everything else. Vendors who lock your data in are telling you what to expect when you need them most.

Bottom line

This week, copy the 15 questions into a document and send them to your shortlisted vendors in writing. Give them a deadline. Written answers are comparable; demo promises are not.

This quarter, score the answers with security, IT and legal in the room, then pilot the top scorer on one gate. The metric to watch during the pilot is not check-in speed; it is how many of the 15 answers turn out to be exactly as written.